Bill Text: TX SB15 | 2021-2022 | 87th Legislature | Enrolled

---

Bill Title: Relating to the Texas Consumer Privacy Act Phase I; creating criminal offenses; increasing the punishment for an existing criminal offense.

Sponsorship: Broadly Bipartisan Bill

Status: (Passed) 2021-06-18 - Effective immediately [SB15 Detail]

Download: Texas-2021-SB15-Enrolled.html

---

S.B. No. 15

AN ACT
relating to the Texas Consumer Privacy Act Phase I; creating
criminal offenses; increasing the punishment for an existing
criminal offense.
BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:
SECTION 1. This Act may be cited as the Texas Consumer
Privacy Act Phase I.
SECTION 2. Section 11.030, Parks and Wildlife Code, is
amended by amending Subsections (a) and (c) and adding Subsections
(e-1), (e-2), and (e-3) to read as follows:
(a) The name and address and a telephone, social security,
driver's license, bank account, credit card, or charge card number
of a person who purchases customer products, licenses, or services
from the department may not be disclosed, sold, rented, or traded
except as authorized under this section or Section 12.0251.
(c) The commission by rule shall adopt policies relating to:
(1) the release of the customer information; and
(2) the use of the customer information by the
department[; and
[(3) the sale of a mailing list consisting of the names
and addresses of persons who purchase customer products, licenses,
or services].
(e-1) The department may disclose statistical data and
compilations of customer information described by Subsection (a) if
the information does not reveal information identifying a specific
department customer or a department customer's address, telephone
number, social security number, or driver's license number.
(e-2) The department may disclose customer information
described by Subsection (a) only:
(1) to another governmental body, including a law
enforcement entity, as needed to carry out a governmental purpose;
(2) if the customer that is the subject of the
information consents in writing to the specific disclosure; or
(3) if the information is:
(A) part of a record that is considered to be a
public record under Section 31.039; or
(B) authorized to be disclosed under Section
31.0391.
(e-3) This section does not authorize the department to
disclose information the department is prohibited from disclosing
by other law.
SECTION 3. Section 204.011(a), Transportation Code, is
amended to read as follows:
(a) The [Except as provided by this section or a rule
adopted by the commission under this section, the] department may
not disclose to any person the name, address, telephone number,
social security account number, driver's license number, bank
account number, credit or debit card number, or charge account
number of a person who:
(1) is or has been a subscriber to "Texas Highways"; or
(2) has purchased from the department a promotional
item described by Section 204.009.
SECTION 4. Section 548.601(a), Transportation Code, is
amended to read as follows:
(a) A person, including an inspector or an inspection
station, commits an offense if the person:
(1) submits information to the department's inspection
database or issues a vehicle inspection report with knowledge that
the submission or issuance is in violation of this chapter or rules
adopted under this chapter;
(2) falsely or fraudulently represents to the owner or
operator of a vehicle that equipment inspected or required to be
inspected must be repaired, adjusted, or replaced for the vehicle
to pass an inspection;
(3) misrepresents:
(A) material information in an application in
violation of Section 548.402 or 548.403; or
(B) information filed with the department under
this chapter or as required by department rule;
(4) submits information to the department's inspection
database or issues a vehicle inspection report:
(A) without authorization to issue the report or
submit the information; or
(B) without inspecting the vehicle;
(5) submits information to the department's inspection
database indicating that a vehicle has passed the applicable
inspections or issues a passing vehicle inspection report for a
vehicle with knowledge that the vehicle has not been repaired,
adjusted, or corrected after an inspection has shown a repair,
adjustment, or correction to be necessary;
(6) knowingly submits information to the department's
inspection database or issues a vehicle inspection report:
(A) for a vehicle without conducting an
inspection of each item required to be inspected; or
(B) for a vehicle that is missing an item
required to be inspected or that has an item required to be
inspected that is not in compliance with state law or department
rules;
(7) refuses to allow a vehicle's owner to have a
qualified person of the owner's choice make a required repair,
adjustment, or correction;
(8) charges for an inspection an amount greater than
the authorized fee;
(9) discloses or sells information collected in
relation to the vehicle inspection program under this chapter about
a unique customer or a unique vehicle owner to a person other than
the department or the person who is the subject of the information,
including a customer or vehicle owner's name, address, or phone
number; or
(10) [(9)] performs an act prohibited by or fails to
perform an act required by this chapter or a rule adopted under this
chapter.
SECTION 5. Section 730.003, Transportation Code, is amended
by adding Subdivision (1-a) and amending Subdivision (6) to read as
follows:
(1-a) "Authorized recipient" means a person who is
permitted to receive and use personal information from an agency in
a manner authorized by this chapter.
(6) "Personal information" means information that
identifies a person, including an individual's photograph or
computerized image, social security number, date of birth, driver
identification number, name, address, but not the zip code, e-mail
address, telephone number, and medical or disability information.
The term does not include:
(A) information on vehicle accidents, driving or
equipment-related violations, or driver's license or registration
status; or
(B) information contained in an accident report
prepared under:
(i) Chapter 550; or
(ii) former Section 601.004 before
September 1, 2017.
SECTION 6. Section 730.006, Transportation Code, is amended
to read as follows:
Sec. 730.006. REQUIRED DISCLOSURE WITH CONSENT. Personal
information obtained by an agency in connection with a motor
vehicle record shall be disclosed to a requestor who:
(1) is the subject of the information; or
(2) demonstrates, in such form and manner as the
agency requires, that the requestor has obtained the written
consent of the person who is the subject of the information.
SECTION 7. The heading to Section 730.007, Transportation
Code, is amended to read as follows:
Sec. 730.007. PERMITTED DISCLOSURES OF CERTAIN PERSONAL
INFORMATION.
SECTION 8. Section 730.007, Transportation Code, is amended
by amending Subsection (a) and adding Subsections (a-1), (a-2), and
(g) to read as follows:
(a) Personal information obtained by an agency in
connection with a motor vehicle record may be disclosed to any
requestor by an agency if the requestor:
(1) provides the requestor's name and address and any
proof of that information required by the agency; and
(2) represents that the use of the personal
information will be strictly limited to:
(A) use by:
(i) a government agency, including any
court or law enforcement agency, in carrying out its functions; or
(ii) a private person or entity acting on
behalf of a government agency in carrying out the functions of the
agency;
(B) use in connection with a matter of:
(i) motor vehicle or motor vehicle operator
safety;
(ii) motor vehicle theft;
(iii) motor vehicle product alterations,
recalls, or advisories;
(iv) performance monitoring of motor
vehicles, motor vehicle parts, or motor vehicle dealers; or
(v) [motor vehicle market research
activities, including survey research; or
[(vi)] removal of nonowner records from the
original owner records of motor vehicle manufacturers;
(C) use in the normal course of business by a
legitimate business or an authorized agent of the business, but
only:
(i) to verify the accuracy of personal
information submitted by the individual to the business or the
agent of the business; and
(ii) if the information is not correct, to
obtain the correct information, for the sole purpose of preventing
fraud by, pursuing a legal remedy against, or recovering on a debt
or security interest against the individual;
(D) use in conjunction with a civil, criminal,
administrative, or arbitral proceeding in any court or government
agency or before any self-regulatory body, including service of
process, investigation in anticipation of litigation, execution or
enforcement of a judgment or order, or under an order of any court;
(E) use in research or in producing statistical
reports, but only if the personal information is not published,
redisclosed, or used to contact any individual;
(F) use by an insurer, [or] insurance support
organization, or [by a] self-insured entity, or an authorized agent
of an insurer, insurance support organization, or self-insured
entity [the entity], in connection with claims processing or
investigation activities, antifraud activities, rating, or
underwriting;
(G) use in providing notice to an owner of a
vehicle that was towed or impounded and is in the possession of a
vehicle storage facility;
(H) use by a licensed private investigator agency
or licensed security service for a purpose permitted under this
section;
(I) use by an employer or an agent or insurer of
the employer to obtain or verify information relating to a holder of
a commercial driver's license that is required under 49 U.S.C.
Chapter 313;
(J) use in connection with the operation of a
[private] toll transportation facility or another type of
transportation project described by Section 370.003;
(K) use by a consumer reporting agency, as
defined by the Fair Credit Reporting Act (15 U.S.C. Section 1681 et
seq.), for a purpose permitted under that Act;
(L) use by a motor vehicle manufacturer,
dealership, or distributor, or an agent of or provider of services
to a motor vehicle manufacturer, dealership, or distributor, for
motor vehicle market research activities, including survey
research;
(M) use in the ordinary course of business by a
person or authorized agent of a person who:
(i) holds a salvage vehicle dealer license
issued under Chapter 2302, Occupations Code;
(ii) holds an independent motor vehicle
dealer or wholesale motor vehicle auction general distinguishing
number issued under Chapter 503 of this code;
(iii) holds a used automotive parts
recycler license issued under Chapter 2309, Occupations Code; or
(iv) is licensed by, registered with, or
subject to regulatory oversight by the Texas Department of Motor
Vehicles, the Texas Department of Banking, the Department of
Savings and Mortgage Lending, the Credit Union Department, the
Office of Consumer Credit Commissioner, the Texas Department of
Insurance, the Board of Governors of the Federal Reserve System,
the Office of the Comptroller of the Currency, the Federal Deposit
Insurance Corporation, the Consumer Financial Protection Bureau,
or the National Credit Union Administration; or
(N) use by an employer, principal, general
contractor, nonprofit organization, charitable organization, or
religious institution to obtain or verify information relating to a
person who holds a driver's license or the driving history of a
person who holds a driver's license if the person is employed by,
works under a contract with, or volunteers for the employer,
principal, contractor, organization, or institution [(L) use for
any other purpose specifically authorized by law that relates to
the operation of a motor vehicle or to public safety].
(a-1) Personal information obtained by the Texas Department
of Motor Vehicles in connection with a motor vehicle record may be
disclosed:
(1) when referring potential violations to the Texas
Office of Consumer Credit Commissioner, the Department of Public
Safety, law enforcement agencies, or the comptroller, if the
personal information is necessary for carrying out regulatory
functions;
(2) to the attorney general as part of a response by
the Texas Department of Motor Vehicles to a subpoena or a discovery
request, if the personal information is necessary for litigation
purposes; or
(3) to a county assessor-collector if the personal
information is related to a finding from an audit or investigation
conducted under Section 520.010.
(a-2) Subsection (a)(2)(C) does not authorize the
disclosure of personal information to a natural person who is not a
business licensed by, registered with, or subject to regulatory
oversight by a government agency.
(g) An agency may request that an authorized recipient or
other person in possession of personal information disclosed for a
use authorized by this section provide to the agency information
sufficient for the agency to determine whether the authorized
recipient or person has complied with this chapter, agency rules,
or other law that applies to the disclosed personal information.
The authorized recipient or person shall provide the requested
information not later than the fifth business day after the date the
agency submits the request unless the agency extends the deadline
to provide a reasonable period to produce the requested
information.
SECTION 9. Chapter 730, Transportation Code, is amended by
adding Sections 730.0121, 730.0122, and 730.0123 to read as
follows:
Sec. 730.0121. DELETION OF INFORMATION REQUIRED IF NOT
AUTHORIZED RECIPIENT. An agency by rule shall require a requestor
to delete from the requestor's records personal information
received from the agency under this chapter if the requestor
becomes aware that the requestor is not an authorized recipient of
that information.
Sec. 730.0122. SALE PROHIBITED. (a) A person may not sell
to a person who is not an authorized recipient personal information
obtained by an agency in connection with a motor vehicle record.
(b) A person commits an offense if the person violates
Subsection (a). An offense under this subsection is a misdemeanor
punishable by a fine not to exceed $100,000.
Sec. 730.0123. CIVIL SUIT. (a) A person who sells to a
person who is not an authorized recipient personal information
obtained by an agency in connection with a motor vehicle record is
liable to the person who is the subject of the information for:
(1) actual damages;
(2) if the actual damages to the person are less than
$2,500, an additional amount so that the total amount of damages
equals $2,500; and
(3) court costs incurred by the person who is the
subject of the information in bringing the action.
(b) A person whose personal information has been disclosed
for compensation to a person who is not an authorized recipient may
sue for:
(1) the damages, costs, and fees authorized under
Subsection (a);
(2) injunctive relief; and
(3) any other equitable remedy determined to be
appropriate by the court.
(c) A district court has exclusive original jurisdiction
over a cause of action brought under this section.
SECTION 10. Section 730.013, Transportation Code, is
amended to read as follows:
Sec. 730.013. [RESALE OR] REDISCLOSURE; OFFENSE. (a) An
authorized recipient of personal information may not [resell or]
redisclose the personal information in the identical or a
substantially identical format the personal information was
disclosed to the recipient by the applicable agency.
(b) An authorized recipient of personal information may
[resell or] redisclose the information, including redisclosure for
compensation, only for a use permitted under Section 730.007.
(c) An [Any] authorized recipient who [resells or]
rediscloses personal information obtained from an agency shall be
required by that agency to:
(1) maintain for a period of not less than five years
records as to any person or entity receiving that information and
the permitted use for which it was obtained; and
(2) provide copies of those records to the agency on
request.
(c-1) A person who receives personal information under
Subsection (b) may not redisclose the personal information,
including redisclosure for compensation, to a person who is not an
authorized recipient.
(c-2) An authorized recipient shall notify each person who
receives personal information from the authorized recipient that
the person may not redisclose the personal information to a person
who is not an authorized recipient.
(d) A person commits an offense if the person violates this
section. An offense under this subsection is a misdemeanor
punishable by a fine not to exceed $100,000 [$25,000].
SECTION 11. The heading to Section 730.014, Transportation
Code, is amended to read as follows:
Sec. 730.014. AGENCY RULES,[; ORGANIZATION OF] RECORDS, AND
CONTRACTS.
SECTION 12. Section 730.014, Transportation Code, is
amended by adding Subsections (c), (d), (e), (f), and (g) to read as
follows:
(c) An agency that provides a requestor access to personal
information in motor vehicle records in bulk under a contract under
Section 730.007 shall include in the contract:
(1) a requirement that the requestor post a
performance bond in an amount of not more than $1 million;
(2) a prohibition on the sale or redisclosure of the
personal information for the purpose of marketing extended vehicle
warranties by telephone;
(3) a requirement that the requestor provide proof of
general liability and cyber-threat insurance coverage in an amount
specified by the contracting agency that is:
(A) at least $3 million; and
(B) reasonably related to the risks associated
with unauthorized access and use of the records;
(4) a requirement that if a requestor experiences a
breach of system security, as defined by Section 521.053, Business &
Commerce Code, that includes data obtained under Section 730.007,
the requestor must notify the agency of the breach not later than 48
hours after the discovery of the breach;
(5) a requirement that the requestor include in each
contract with a third party that receives the personal information
from the requestor that the third party must comply with federal and
state laws regarding the records;
(6) a requirement that the requestor and any third
party receiving the personal information from the requestor protect
the personal information with appropriate and accepted industry
standard security measures for the type of information and the
known risks from unauthorized access and use of the information;
and
(7) a requirement that the requestor annually provide
to the agency a report of all third parties to which the personal
information was disclosed under this section and the purpose of the
disclosure.
(d) The bond and insurance requirements in Subsections
(c)(1) and (3) do not apply to a contract under Section 730.007
between a government agency and another government agency,
including a court or law enforcement agency.
(e) An agency that discloses any motor vehicle records in
bulk under Section 730.007 shall include in the records at least two
records that are created solely for the purpose of monitoring
compliance with this chapter and detecting, by receipt of certain
forms of communications or actions directed at the subjects of the
created records, potential violations of this chapter or contract
terms required by this section.
(f) An agency that discloses motor vehicle records shall
designate an employee to be responsible for:
(1) monitoring compliance with this chapter and
contract terms required by this section;
(2) referring potential violations of this chapter to
law enforcement agencies; and
(3) making recommendations to the administrative head
of the agency or the designee of the administrative head of the
agency on the eligibility of a person under Section 730.016 to
receive personal information.
(g) This subsection does not affect any rights or remedies
available under a contract or any other law. If an agency
determines that a person has violated a term of a contract with the
agency for the disclosure under this chapter of personal
information obtained by the agency in connection with a motor
vehicle record, the agency may:
(1) cease disclosing personal information to that
person; and
(2) allow the person to remedy the violation and
resume receiving personal information.
SECTION 13. The heading to Section 730.016, Transportation
Code, is amended to read as follows:
Sec. 730.016. INELIGIBILITY OF CERTAIN PERSONS TO RECEIVE,
RETAIN, OR REDISCLOSE PERSONAL INFORMATION; OFFENSE.
SECTION 14. Section 730.016, Transportation Code, is
amended by amending Subsection (a) and adding Subsection (c) to
read as follows:
(a) A person who is convicted of an offense under this
chapter, or who violates a rule adopted by an agency relating to the
terms or conditions for a release of personal information,
including a rule adopted under Section 730.0121:
(1) [to the person,] is ineligible to receive personal
information under Section 730.007;
(2) not later than one year after the date of
conviction or the court's final determination under this
subsection, shall delete from the person's records all personal
information received under this chapter; and
(3) may not redisclose personal information received
under this chapter.
(c) A person commits an offense if the person violates this
section. An offense under this subsection is a misdemeanor
punishable by a fine not to exceed $100,000.
SECTION 15. The following provisions are repealed:
(1) Section 11.030(d), Parks and Wildlife Code; and
(2) Sections 204.011(c) and (d), Transportation Code.
SECTION 16. The changes in law made by this Act apply only
to an offense committed on or after the effective date of this Act.
An offense committed before the effective date of this Act is
governed by the law in effect on the date the offense was committed,
and the former law is continued in effect for that purpose. For
purposes of this section, an offense was committed before the
effective date of this Act if any element of the offense occurred
before that date.
SECTION 17. (a) Section 730.0121, Transportation Code, as
added by this Act, applies to a person who received personal
information under Chapter 730, Transportation Code, before the
effective date of this Act, and is not an authorized recipient, as
defined by Section 730.003(1-a), Transportation Code, as added by
this Act, of that personal information under Chapter 730,
Transportation Code, as amended by this Act.
(b) Notwithstanding Subsection (a) of this section, an
agency to which Section 730.0121, Transportation Code, as added by
this Act, applies may not require a person who received personal
information from the agency before the effective date of this Act
and is not an authorized recipient, as defined by Section
730.003(1-a), Transportation Code, as added by this Act, of that
information to delete the information before the first anniversary
of the effective date of this Act.
SECTION 18. This Act takes effect immediately if it
receives a vote of two-thirds of all the members elected to each
house, as provided by Section 39, Article III, Texas Constitution.
If this Act does not receive the vote necessary for immediate
effect, this Act takes effect September 1, 2021.
______________________________ ______________________________
President of the Senate Speaker of the House
I hereby certify that S.B. No. 15 passed the Senate on
April 14, 2021, by the following vote: Yeas 31, Nays 0;
May 27, 2021, Senate refused to concur in House amendments and
requested appointment of Conference Committee; May 28, 2021, House
granted request of the Senate; May 30, 2021, Senate adopted
Conference Committee Report by the following vote: Yeas 31,
Nays 0.
______________________________
Secretary of the Senate
I hereby certify that S.B. No. 15 passed the House, with
amendments, on May 25, 2021, by the following vote: Yeas 146,
Nays 0, one present not voting; May 28, 2021, House granted request
of the Senate for appointment of Conference Committee;
May 30, 2021, House adopted Conference Committee Report by the
following vote: Yeas 140, Nays 0, two present not voting.
______________________________
Chief Clerk of the House
Approved:
______________________________
Date
______________________________
Governor